CVE-2026-61825: code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable SharpFormEditorField::RAWHTML must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAWHTML functionality where it is not required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 9.22.5 - Configuration
Disable RAW_HTML functionality where it is not required.
code16 Sharp SharpFormEditorField::RAW_HTML = disabled - Compensating control
Sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer; applications that intentionally enable SharpFormEditorField::RAW_HTML must continue sanitizing editor content themselves.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the stored payload?
An attacker needs privileges to submit content through the affected SharpEditorFormField and must persuade or wait for another user to view the stored content. The impact can extend to the viewing user's browser, including confidentiality and integrity effects.
Are all deployments protected by upgrading to version 9.22.5?
Version 9.22.5 is identified as patched. However, applications that intentionally enable SharpFormEditorField::RAW_HTML must continue to sanitize editor content themselves.
What can be done if the update cannot be applied immediately?
Sanitize all editor content before it is stored or rendered, such as by using Symfony HtmlSanitizer. Disable RAW_HTML where it is not required.